Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

build(deps): bump github.com/sigstore/rekor from 1.1.0 to 1.1.1 #18450

Closed
wants to merge 1 commit into from
Closed

build(deps): bump github.com/sigstore/rekor from 1.1.0 to 1.1.1 #18450

wants to merge 1 commit into from

Conversation

dependabot[bot]
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github May 3, 2023

Bumps github.com/sigstore/rekor from 1.1.0 to 1.1.1.

Release notes

Sourced from github.com/sigstore/rekor's releases.

v1.1.1

Functional Enhancements

  • Refactor Trillian client with exported methods (#1454)
  • Switch to official redis-go client (#1459)
  • Remove replace in go.mod (#1444)
  • Add Rekor OID info. (#1390)

Quality Enhancements

  • remove legacy encrypted cosign key (#1446)
  • swap cjson dependency (#1441)
  • Update release readme (#1456)

Bug Fixes

Contributors

  • Billy Lynch
  • Bob Callaway
  • Carlos Tadeu Panato Junior
  • Ceridwen Coghlan
  • Hayden B

Full Changelog: sigstore/rekor@v1.1.0...v1.1.1

Changelog

Sourced from github.com/sigstore/rekor's changelog.

v1.1.1

Functional Enhancements

  • Refactor Trillian client with exported methods (#1454)
  • Switch to official redis-go client (#1459)
  • Remove replace in go.mod (#1444)
  • Add Rekor OID info. (#1390)

Quality Enhancements

  • remove legacy encrypted cosign key (#1446)
  • swap cjson dependency (#1441)
  • Update release readme (#1456)

Bug Fixes

Contributors

  • Billy Lynch
  • Bob Callaway
  • Carlos Tadeu Panato Junior
  • Ceridwen Coghlan
  • Hayden B
Commits

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

@dependabot
build(deps): bump github.com/sigstore/rekor from 1.1.0 to 1.1.1
99131b4 
Bumps [github.com/sigstore/rekor](https://github.com/sigstore/rekor) from 1.1.0 to 1.1.1.
- [Release notes](https://github.com/sigstore/rekor/releases)
- [Changelog](https://github.com/sigstore/rekor/blob/main/CHANGELOG.md)
- [Commits](sigstore/rekor@v1.1.0...v1.1.1)

---
updated-dependencies:
- dependency-name: github.com/sigstore/rekor
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
@openshift-ci openshift-ci bot added do-not-merge/release-note-label-needed Enforce release-note requirement, even if just None and removed do-not-merge/release-note-label-needed Enforce release-note requirement, even if just None labels May 3, 2023
@openshift-ci
Copy link
Contributor

openshift-ci bot commented May 3, 2023

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: dependabot[bot]
Once this PR has been reviewed and has the lgtm label, please assign jwhonce for approval. For more information see the Kubernetes Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@vrothberg
Copy link
Member

vrothberg commented May 4, 2023 •
edited 

bin/podman           size= 58831184  delta=734880
***************************************************************************
* bin/podman grew by 734880 bytes; max allowed is 51200.

@mtrmac probably something we need to look into soon.

Early warning to @Luap99 to prevent a heart attack.

@vrothberg vrothberg closed this May 4, 2023
@dependabot @github
Copy link
Contributor Author

dependabot bot commented on behalf of github May 4, 2023

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.

@vrothberg vrothberg deleted the dependabot/go_modules/github.com/sigstore/rekor-1.1.1 branch May 4, 2023 13:09
@mtrmac
Copy link
Collaborator

mtrmac commented May 4, 2023

containers/image#1845 will help with the size — but I think we can reasonably do that only after we have an integration test of that custom client implementation against a server.

mtrmac
mtrmac reviewed May 4, 2023
View reviewed changes
vendor/github.com/sigstore/rekor/pkg/util/trillian_client.go
Comment on lines +24 to +34
"github.com/sigstore/rekor/pkg/log"
"github.com/transparency-dev/merkle/proof"
"github.com/transparency-dev/merkle/rfc6962"

"google.golang.org/grpc/codes"
"google.golang.org/grpc/status"
"google.golang.org/protobuf/types/known/durationpb"

"github.com/google/trillian"
"github.com/google/trillian/client"
"github.com/google/trillian/types"
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This seems to be one cause of the size growth; should be fairly plausible to avoid in Rekor upstream.

vendor/github.com/sigstore/rekor/pkg/log/log.go
Comment on lines +22 to +24
"github.com/go-chi/chi/middleware"
"go.uber.org/zap"
"go.uber.org/zap/zapcore"
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Other part of the growth…

@mtrmac
Copy link
Collaborator

mtrmac commented May 4, 2023

  • bin/podman grew by 734880 bytes; max allowed is 51200.

sigstore/rekor#1469 should undo all of the additions from this version, as well as remove another dependency subtree that we have accepted previously. Hopefully that can be merged upstream, and vendored into Podman, pretty soon, without waiting for the perfect solution.

@vrothberg
Copy link
Member

Great work, @mtrmac !

@github-actions github-actions bot added the locked - please file new issue/PR Assist humans wanting to comment on an old issue or PR with locked comments. label Aug 25, 2023
@github-actions github-actions bot locked as resolved and limited conversation to collaborators Aug 25, 2023
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Reviewers

@mtrmac mtrmac mtrmac left review comments

Assignees
No one assigned
Labels
locked - please file new issue/PR Assist humans wanting to comment on an old issue or PR with locked comments. release-note-none
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

None yet
2 participants
@vrothberg @mtrmac